feat: auth0 server import restructure

.github/workflows/codeql.yml

@@ -39,15 +39,15 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/autobuild@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           category: '/language:${{ matrix.language }}'

.github/workflows/rl-secure.yml

@@ -60,7 +60,8 @@ jobs:
         env:
           ARTIFACT_NAME: ${{ inputs.artifact-name }}
         run: |
-          tar -czvf "$ARTIFACT_NAME" *
+          pnpm pack --pack-destination .
+          mv *.tgz "$ARTIFACT_NAME"
 
       - id: get_version
         uses: ./.github/actions/get-version

.gitignore

@@ -137,6 +137,7 @@ dist
 # local development files
 .memory/
 .dev-files/
+examples/migration-validation/
 *.env.*
 !**/.env.example
 *.tmp

.version

@@ -1 +1 @@
-v4.27.0
+v4.28.0

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Change Log
 
+## [v4.28.0](https://github.com/auth0/nextjs-auth0/tree/v4.28.0) (2026-08-28)
+[Full Changelog](https://github.com/auth0/nextjs-auth0/compare/v4.27.0...v4.28.0)
+
+**Added**
+-  feat: add connected-accounts disconnect and listing with orphan cookie cleanup [\#2784](https://github.com/auth0/nextjs-auth0/pull/2784) ([Piyush-85](https://github.com/Piyush-85))
+
+**Security**
+- fix: bump next.js to patched versions (15.5.24, 16.3.3) addressing cr… [\#2824](https://github.com/auth0/nextjs-auth0/pull/2824) ([Piyush-85](https://github.com/Piyush-85))
+
 ## [v4.27.0](https://github.com/auth0/nextjs-auth0/tree/v4.27.0) (2026-08-18)
 [Full Changelog](https://github.com/auth0/nextjs-auth0/compare/v4.26.0...v4.27.0)
 

README.md

@@ -191,7 +191,7 @@ export default async function Home() {
 ```
 
 > [!IMPORTANT]  
-> You must use `<a>` tags instead of the `<Link>` component to ensure that the routing is not done client-side as that may result in some unexpected behavior.
+> A default `<Link href="/auth/login">` is safe — the SDK detects the AUTO prefetch header and returns `204 No Content` without writing a transaction cookie. Avoid `<Link href="/auth/login" prefetch={true}>` (FULL prefetch): it sends no detectable prefetch header, so the SDK cannot distinguish it from a real navigation and will start a login flow. Use a plain `<a>` tag or `<Link prefetch={false}>` if you need to be safe across all prefetch modes. See [Preventing "431 Request Header Fields Too Large" Errors](https://github.com/auth0/nextjs-auth0/blob/main/EXAMPLES.md#preventing-431-request-header-fields-too-large-errors) for details.
 
 ## Customizing the client